BSP tightens rules on bank cyberhacks

Banks must now report to authorities any cyberhacking incident or disruption to technology-based financial services they provide clients within two hours of their discovery, the central bank said on Friday.

In a statement, the Bangko Sentral ng Pilipinas (BSP) said these new regulations—significantly tighter than the 10-day reporting window previously allowed for such events—were being put in place “in response to the increasingly persistent, sophisticated and targeted attacks launched against financial institutions.”

“Prompt reporting of these incidents by supervised financial institutions will allow the Bangko Sentral to have an enhanced visibility on the changing information technology risk landscape and to proactively ensure that their impact and resulting risks are minimized and contained to avert potential systemic risks to the financial system,” it said.

Banking industry insiders have noted that local financial institutions have been experiencing more cyberhacking attempts in recent years, from suspected large scale attempts to compromise bank computers to small scale “phishing” activities perpetrated on unsuspecting clients.

Some large local banks have also experienced disruptions in their ATM network services, some lasting as long as four days, causing inconveniences to thousands of clients.

The tighter regulations in response to these issues were approved by the Monetary Board recently to cover “cyber-related incidents and operational disruptions.”

“This is necessary in view of the speed of exploitation, proliferation of attack tools and actors, and potentially massive extent of damage from cyber-related incidents,” it explained.

Having quick access to information on these incidents will enable regulators to alert other banks, industry associations and other relevant stakeholders that may be affected by a specific attack.

After the initial notification, the affected financial institutions are likewise mandated to submit a follow-up report within 24 hours from the incident containing information such as the manner and time of initial detection, impact of the incident and initial remedial response.

“The BSP shall closely monitor the situation, coordinate with the concerned financial institution and undertake appropriate supervisory actions if warranted, until full resolution of the incident,” it said.

The BSP may also issue appropriate advisories, security bulletins or policies to prevent recurrence of the incident and promote enterprise and industry-wide operational resilience.

“The new regulations further strengthen the BSP’s cyber-threat surveillance capabilities crucial for industry-wide cyber-preparedness, protection and crisis management,” the central bank said.